[aw-maintenance:compiler-security] github/gh-aw compiler run failed (zizmor strict-mode) with 298 workflows showing lock-file drift and multiple lint findings

Compiled all 298 gh-aw workflow sources in `github/gh-aw` with the full validation/lint/container/security suite. The compiler run **exited non-zero (1)** because the zizmor step failed in strict mode; findings from actionlint, container-image validation, and gh-aw's own workflow lints are also present. Highest-severity supported issue: the zizmor scanner step itself reports failure (blocking strict-mode compilation) — its own failure message paradoxically states "found 0 security warnings/errors," so the root cause of the non-zero exit is ambiguous from available evidence and needs direct investigation rather than being characterized as a specific vulnerability. Recommended next action: run the local fixing loop below, starting with the zizmor failure, then address the 54 container-image validation failures (Docker daemon unavailable in this environment) and the 62 lock-file "unapproved action" safe-update warnings.

- **Target repository**: `github/gh-aw`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `298`
- **Generated lock files checked**: `298`
- **Result**: `findings`

### Findings

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| zizmor | all 298 compiled workflows (batch run) | unknown (step reports "failed" but message states 0 findings) | `✗ zizmor failed` — strict mode requires zero zizmor findings; the printed message is self-contradictory ("found 0 security warnings/errors ... must have no zizmor findings"), so the actual cause of the non-zero exit is unclear from this evidence alone | Re-run `zizmor` directly (not via the wrapped compiler message) to get the real finding list/exit reason; do not assume 0 findings actually means clean |
| gh-aw compiler (container validation) | `ghcr.io/oraios/serena:1.7.0` referenced by `spec-librarian.md`, `terminal-stylist.md`, `typist.md` (54 total occurrences across workflows) | unknown | "docker daemon not running — could not validate container image" | Not a code defect; requires Docker daemon available in the compiling environment, or `--validate-images` can be omitted where infeasible |
| gh-aw compiler (safe-output update-mode guard) | 62 workflows, e.g. `agent-job-health.md`, `weekly-blog-post-writer.md`, `workflow-normalizer.md` | unknown | "safe update mode detected unapproved changes" — previously-approved `docker/build-push-action` and `docker/setup-buildx-action` were removed from lock files | Use `--approve` if the removal is intentional, or revert the action removal, or have a reviewer approve via the interactive coding agent flow |
| gh-aw compiler (permissions check) | 8 workflows, e.g. `daily-security-red-team.md`, `test-quality-sentinel.md`, `hippo-embed.md` | unknown | Missing required `issues: read` (or similar) permission for configured GitHub toolsets | Add the missing permission block to workflow frontmatter, or remove the toolset requiring it |
| gh-aw compiler (concurrency lint) | 31 `workflow_dispatch` workflows, e.g. `ci-doctor.md`, `commit-changes-analyzer.md`, `squad.md` | unknown | No `concurrency.job-discriminator`; concurrent dispatches share one slot | Add `concurrency.job-discriminator: ${{ github.run_id }}` (or similar) to each affected workflow |
| gh-aw compiler (sandbox policy) | 100 workflows, e.g. `ace-editor.md`, `super-linter.md`, `video-analyzer.md` | unknown | `sandbox.agent.runtime: cloud-hypervisor` uses a privileged KVM preview path with attached MCP gateway; requires explicit human security review before merge/rollout | Obtain and record explicit human approval per repository process, or switch runtime if approval is not intended |
| gh-aw compiler (schema validation) | `aw.json` (3 occurrences) | unknown | `auto_upgrade` field fails schema oneOf (object provided, boolean expected); compiler falls back to defaults | Fix `auto_upgrade` value in `aw.json` to match the expected schema (boolean or valid object variant) |

### Local fixing loop

1. Install or update the gh-aw extension, then configure your coding agent's MCP client to launch `gh aw mcp-server` over stdio from the `github/gh-aw` repository.
2. Give the agent the prompt below and require it to use the `fix` and `compile` MCP tools rather than editing generated `.lock.yml` files directly.
3. Require the agent to repeat the full compiler validation and security scan (strict mode, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, syft) until it passes cleanly, or stop and explain any finding that cannot be safely auto-fixed.

Agent prompt

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence (bounded excerpts)

Report is 1580 lines / ~100KB; showing key excerpts only.

```
.github/workflows/aw.json: warning: failed to load aw.json; compilation will continue with defaults, and action_failure_issue_expires will fall back to 168 hours where applicable: .github/workflows/aw.json does not match the expected schema: jsonschema validation failed with '(contoso.com/redacted)
- at '/auto_upgrade': 'oneOf' failed, none matched
- at '/auto_upgrade': got object, want boolean
```

```
i Using actionlint 1.7.12
i Running actionlint (with shellcheck/pyflakes) on 298 files
i Running zizmor security scanner on 298 files
✗ zizmor failed
strict mode: zizmor found 0 security warnings/errors in workflows - workflows must have no zizmor findings in strict mode
```

```
.github/workflows/spec-librarian.md: warning: container image validation failed: [...]
tool 'serena': docker daemon not running - could not validate container image 'ghcr.io/oraios/serena:1.7.0'.
```

```
.github/workflows/agent-job-health.md: warning: safe update mode detected unapproved changes
Previously-approved action(s) removed:
- docker/build-push-action
- docker/setup-buildx-action
```

No poutine, runner-guard, grant, grype, or syft output lines were found in `report.txt`; these tools may not have been invoked in this deterministic run, or their sections were not distinguishable in the captured log. Treat their status as not confirmed rather than clean.

Diff summary

298 lock files changed (all pre-existing `.github/workflows/*.lock.yml`), 15,114 insertions, 35,641 deletions, reflecting compiler-version drift between the currently-committed lock files and the compiler used for this run.

### Control Plane
- Correlation ID: `33813796170-29`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33813796170

> Generated by [:shield: AW Maintenance / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/33814212188) · copilot · auto · 36.1 AIC · ⌖ 8.15 AIC · ⊞ 13.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 17, 2026, 10:49 PM UTC

Start by rerunning zizmor directly against the compiled workflows to determine the non-zero exit cause. Then inspect .github/workflows/aw.json and the affected .github/workflows/*.md sources, using the gh-aw MCP fix and compile tools rather than editing generated lock files. Done means the full validation and security suite passes, or any unresolved findings are documented.

Written by the indexing model from the issue text.